Subject: RE: [ipcdn] draft-ietf-ipcdn-device-mibv2-01.txt

From: "Woundy, Richard" <[email-masked]>
Date: Thu, 18 Apr 2002 10:59:47 -0600

Folks,

The current Security Guidelines uses the following text to warn against
using SNMPv1:

   SNMPv1 by itself is not a secure environment.  Even if the network
   itself is secure (for example by using IPSec), even then, there is no
   control as to who on the secure network is allowed to access and
   GET/SET (read/change/create/delete) the objects in this MIB.

Shouldn't this text also point out that SNMPv2c suffers from the same
security vulnerabilities? Note that SNMPv2c is explicitly mentioned in the
standard MIB boilerplate <http://www.ops.ietf.org/mib-boilerplate.html>.

Thanks to Ran Atkinson for pointing this out.

-- Rich

-----Original Message-----
From: RJ Atkinson [mailto:[email-masked]]
Sent: Tuesday, March 19, 2002 3:23 PM
To: Richard Woundy
Cc: [email-masked]
Subject: Re: [ipcdn] draft-ietf-ipcdn-device-mibv2-01.txt

On Tuesday, March 19, 2002, at 02:40 , Richard Woundy wrote:
> I want to put together an updated version of this internet-draft.

	Thanks very much.  My primary goal is to keep the I-Ds (and
RFCs) in sync with the current reality.

> The wording of the Security Considerations in the drafts in this
> working group is constrained by the following guidance for MIB
> documents from the IETF O&M folks: <http://www.ops.ietf.org/security.html>
> .

> If we want to use text that specifically calls out the dangers/folly
> of using SNMPv2c, we should get feedback from the folks on the
> <[email-masked]> mailing list.

	I believe, based on recent experience with the BGP MIB where
I had essentially the same inputs and my proposal was recently
implemented, that my suggestion regarding "Security Considerations"
for IPCDN MIBs is not conflicting with the URL/guidance from the
MIB wizards.  One could send a quick note to the O&M ADs to obtain
precise confirmation that I am not confused about this point.

	A glance at the very very latest BGP MIB's "Security
Considerations" gives a good example of the kind of things
that I think ought to be there.  I believe this latest I-D's
version is online already, but am not 100% certain this second
as I write this note.

Cheers,

Ran
[email-masked]

_______________________________________________
IPCDN mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipcdn

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 18 Apr 2002 13:13:28 -0400

> standard MIB boilerplate <http://www.ops.ietf.org/mib-boilerplate.html>.

	Thanks.

MIB Folks,

	It should also explicitly note that SNMPv1 and SNMPv2c both use 
clear-text
disclosing passwords -- which are not considered to provide acceptable
security for an IETF protocol.

	We need to start having MIBs mandate that implementers implement
SNMPv3 now that has advanced to Full Standard, IMHO.

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Thu, 18 Apr 2002 13:13:28 -0400

Thanks.

MIB Folks,

Ran

---

From: "C. M. Heard" <[email-masked]>
Date: Fri, 19 Apr 2002 13:15:05 -0700 (PDT)

Richard Woundy wrote:
> documents from the IETF O&M folks: <http://www.ops.ietf.org/security.html>.
>

Please notice that the text of that page starts out with the words

   "This page defines guidelines [... ]"

Since these are guidelines, I would think that you are not constrained
to follow the text exactly if there are good reasons for a deviation.
In particular, strenghtening the standard admonitions might well be
in order for a MIB module that contains extraordinarily information.

> standard MIB boilerplate <http://www.ops.ietf.org/mib-boilerplate.html>.

This may have been an oversight, but there was a good reason to emphasize
SNMPv1 here -- it was (and still is) an Internet Standard and a
recommended protocol, although this will soon change -- while SNMPv2c
was never on the standards track (it was experimental) and was never
a recommended protocol.

The new SNMPv3 documents will be published soon, and the boilerplate will
all have to be updated then.  The admonition against the insecure historic
protocols might as well be updated to say just don't use them.

Mike

---

From: "C. M. Heard" <[email-masked]>
Date: Fri, 19 Apr 2002 13:15:05 -0700 (PDT)

Mike

---

From: RJ Atkinson <[email-masked]>
Date: Mon, 22 Apr 2002 10:23:43 -0400

On Friday, April 19, 2002, at 04:15 , C. M. Heard wrote:
> recommended protocol, although this will soon change

I (erroneously ?) thought SNMPv1 was already moved to HISTORIC
and SNMPv3 to full STANDARD by the IESG.  If IESG has approved,
then the state has already changed even if the new RFCs haven't
made it out of the RFC Editor queue.

>  -- while SNMPv2c

	In practice, many many folks erroneously thought that SNMPv2c
included cryptographic authentication -- and SNMPv2c is quite widely
deployed (mainly in order to use SMIv2), so it is a large part of the
deployed Internet.  On that basis (being a large part of the
deployed Internet), it needs to be discussed in any Security
Considerations section regardless of its theoretical IETF state.

> protocols might as well be updated to say just don't use them.

Agree with all of that.

Ran

---

From: RJ Atkinson <[email-masked]>
Date: Mon, 22 Apr 2002 10:23:43 -0400

Agree with all of that.

Ran